This invention relates to an arrangement for monitoring the operation of a computer system to detect and record security-related events, i.e. incidents that might compromise the security of the system. The invention is particularly, although not exclusively, concerned with security monitoring arrangements for retail systems. By a retail system is meant a system comprising a number of point-of-sale (PoS) terminals, connected to a central computer, for processing transactions in a retail environment.
All retailers suffer losses through fraud or theft. Surveys have revealed that a large proportion of such loss to retailers is attributable to staff activity. This includes collusion at point of sale, for example by passing goods through the checkout without charging them.
One known scheme for countering such losses is to intercept the data sent to the till audit roll printer in each PoS terminal, and to route this data via an intelligent network of concentrating equipment to a central security computer. The security computer monitors the audit roll data received by it, looking for security related events, i.e. events which indicate some potentially suspicious action on the part of the terminal operator, such as for example refunds. When such an event is detected by the security computer, it activates a closed-circuit television (CCTV) camera and video cassette recorder (VCR), to automatically start recording the actions of the terminal operator. At the same time, the till audit roll data is recorded, superimposed on the picture.
However, a problem with this previously proposed scheme is that it is not well integrated with the retail system, and hence is expensive. The object of the invention is to overcome these problems.
According to the invention there is provided a computer system comprising:
(a) a data transmission network;
(b) a plurality of operator terminals connected to the network;
(c) a control computer connected to the network; and
(d) at least one closed circuit television camera and video recorder connected to said control computer;
(e) wherein each of said terminals includes means for monitoring its own operation for predetermined security-related events and, upon detection of such an event, for sending an alert message and event data over the network to said control computer;
(f) and wherein said control computer includes means for responding to said alert message by activating said camera and recorder to record a view of the operator terminal, along with said event data.